.@AlmanaxAI is joining @depthfirstlabs! @mmwtsn and I started the company two years ago because we'd grown tired of seeing weekly multi-million-dollar hacks destroying blockchain companies and stealing people's life savings. We believed the industry needed to move from annual security audits and pentests to continuous ones, and that AI would eventually get us there. We were among the first to see the potential of AI in cyber and build new solutions in this space. When we started, most security teams told us our product wouldn't work, they didn’t need more findings, and they didn't trust AI to be good. But then we saw how the commercial tools our clients were using were missing many of the vulnerabilities we were detecting, while producing an absurd number of false positives. We ended up working with some of the largest blockchain companies: Solana, Stellar, Aptos, Privy and Bridge (now part of Stripe), DFNS, Algorand. When people didn't believe, we showed them results: we found issues in Vitalik's code (arguably one of the best software engineers on Earth), ethically disclosed hundreds of vulnerabilities (to Ripple, Coinbase, Fireblocks), and won security competitions against thousands of researchers. As we progressed, we realized that while crypto companies were among the most vulnerable (exploits directly steal money), the problem was widespread beyond blockchain. The rise of vibe coding created an enormous new attack surface and new models and harnesses were detecting vulnerabilities that had gone unnoticed in software packages for decades, some of which power most of today’s internet. The time between CVE public disclosure and first confirmed in-the-wild exploitation has dropped from 2.3 years in 2018 to eight hours today. This and the release of frontier cyber models shook the industry. So we expanded our product support to languages and tech stacks used widely by enterprises. But the scale of what needs to be done requires more than what any one small team can do alone We believe joining forces with depthfirst will significantly accelerate our shared vision to secure the world’s software. depthfirst is already swinging at the same future we set out to build, with the team and the resources to lead the way. Their bet, and now ours, is that the next major security platform will be in product security. As their investor @arshammem put it, every category eventually gets one company whose name becomes synonymous with it: Palo Alto Networks for the network, CrowdStrike for the endpoint, Wiz for the cloud. Product and application security, notwithstanding many attempts, is still left without a crowned victor. We think depthfirst can be that company. Thanks to our great team, investors, and customers who believed in us and shared our vision of the world. Our ambition is now even bigger and we’re excited to build that future with @qasimmith, @andreamichi, Daniele, and the entire @depthfirstlabs team.

.@hosseeb on why beating North Korea's hackers now comes down to who can afford the most compute: "If the attackers are spending 500 bucks, and good guys are spending maybe a couple bucks, they're like, oh, I just wanna check and see if there's any low-hanging fruit. Otherwise I'm not gonna use this code if I can tell it's obviously busted. So they spend a couple dollars worth of compute, and they say, ah, it looks good enough. It's a well-funded project. It's open source. Yeah, I guess I'll use it." "But North Korea is spending 500 bucks, 1,000 bucks, 2,000 bucks just grinding and grinding and grinding, running multiple agents overnight trying to find an attack." "That means that no matter how many good people are spending $2 worth of GLM compute on you, they will never be able to find the depth of the tree that North Korea is searching for. None of the normal users will ever get there, which means it's only really on the company." "The company is the only party that can coordinate enough compute to be able to actually expand the search space enough to out search an attacker." "But it does mean that attackers have the same problem. So if North Korea and Russia and China are all trying to hack your protocol, but they all spend, let's say, $5,000 each, if you spend $10,000 you will actually find everything that they can find and more." "Which in that sense, it benefits defenders over attackers in the long run, because the company can actually outspend any individual attacker in principle, and that used to be not sufficient defense in the old model because of the fact that attackers were uncorrelated with each other." @dragonflyvc

We discovered 105 vulnerabilities across 34 projects in Ruby, some of which had remained undetected for more than 15 years. Collectively, these projects have been downloaded more than 8.6 billion times. The GitLab Remote Code Execution announced by @depthfirstlabs last week emerged from this broader investigation into the Ruby ecosystem. depthfirst's platform validated these vulnerabilities at scale and generated clear evidence for maintainers. Its supply chain module recorded affected versions as dependency issues, and automatically recommended appropriate upgrades. This research was part of the Open Defense Initiative, a $5m commitment in depthfirst credits to help OSS maintainers secure their projects. Read more about it in the comments. At @depthfirstlabs, some of the brightest minds in security, engineering, and AI are working together to build the OS for security. We're hiring across the board - join us to build a generational company with incredible people and secure the world's software. Full Report: depthfirst.com/research/behi…

We successfully achieved an RCE on GitLab in its default configuration. Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the @depthfirstlabs spirit, we went deeper: into the low-level gem dependency chain beneath GitLab. The result? By sending crafted JSON data, we could exploit memory-corruption vulnerabilities buried deep in that chain and take control of the GitLab application server. @depthfirstlabs brings together some of the smartest people, and is building the best security AI agent. Follow our work, and come join us! Read more about this in the comment...

July 2026 may end up being remembered as one of the most important days in cybersecurity and human history. Last week, @huggingface was attacked by a fully autonomous system. Today’s update from @OpenAI that this attack was caused by their testing further reinforces something that’s becoming hard to ignore: autonomous cyber capabilities are advancing faster than anyone predicted. Sure - the frontier labs have added classifiers that prevent cyber use but 1) these classifiers are not foolproof and 2) open weight models are already close to the frontier level: there is no putting this genie back in the bottle. We are at a crossroads today. I wrote about this incident and what needs to happen in the following post (link in comments).

Thank you @Nasdaq for featuring the acquisition of @AlmanaxAI by @depthfirstlabs in Times Square! A pretty great way to say goodbye to New York before moving back to San Francisco. depthfirst is growing quickly and hiring across the company. If there's a role you’re interested in, send me a DM!

Big one for @AlmanaxAI! One of the sharpest teams we've watched work, and they're chasing something the whole space actually needs. Excited to see what you guys cook up at @depthfirstlabs. go build 🫡

.@AlmanaxAI is joining @depthfirstlabs! @mmwtsn and I started the company two years ago because we'd grown tired of seeing weekly multi-million-dollar hacks destroying blockchain companies and stealing people's life savings. We believed the industry needed to move from annual security audits and pentests to continuous ones, and that AI would eventually get us there. We were among the first to see the potential of AI in cyber and build new solutions in this space. When we started, most security teams told us our product wouldn't work, they didn’t need more findings, and they didn't trust AI to be good. But then we saw how the commercial tools our clients were using were missing many of the vulnerabilities we were detecting, while producing an absurd number of false positives. We ended up working with some of the largest blockchain companies: Solana, Stellar, Aptos, Privy and Bridge (now part of Stripe), DFNS, Algorand. When people didn't believe, we showed them results: we found issues in Vitalik's code (arguably one of the best software engineers on Earth), ethically disclosed hundreds of vulnerabilities (to Ripple, Coinbase, Fireblocks), and won security competitions against thousands of researchers. As we progressed, we realized that while crypto companies were among the most vulnerable (exploits directly steal money), the problem was widespread beyond blockchain. The rise of vibe coding created an enormous new attack surface and new models and harnesses were detecting vulnerabilities that had gone unnoticed in software packages for decades, some of which power most of today’s internet. The time between CVE public disclosure and first confirmed in-the-wild exploitation has dropped from 2.3 years in 2018 to eight hours today. This and the release of frontier cyber models shook the industry. So we expanded our product support to languages and tech stacks used widely by enterprises. But the scale of what needs to be done requires more than what any one small team can do alone We believe joining forces with depthfirst will significantly accelerate our shared vision to secure the world’s software. depthfirst is already swinging at the same future we set out to build, with the team and the resources to lead the way. Their bet, and now ours, is that the next major security platform will be in product security. As their investor @arshammem put it, every category eventually gets one company whose name becomes synonymous with it: Palo Alto Networks for the network, CrowdStrike for the endpoint, Wiz for the cloud. Product and application security, notwithstanding many attempts, is still left without a crowned victor. We think depthfirst can be that company. Thanks to our great team, investors, and customers who believed in us and shared our vision of the world. Our ambition is now even bigger and we’re excited to build that future with @qasimmith, @andreamichi, Daniele, and the entire @depthfirstlabs team.

@AlmanaxAI is joining @depthfirstlabs! The window to get AI security right is narrowing. As models get more capable and the attack surface expands, defenders need to move faster than the threat. When we met @francescpicc and team, it was clear they had been working through the same hard problems and shared our view of where security is going. We’re thrilled to welcome them onboard.

Reminder that Solana builders are eligible for a free year of @AlmanaxAI - Detection - Threat Modeling - PR Reviews - Custom Rules - Agents Learning - AI Triage - Auto-Patching